STRATEGIES USED BY ADVERSARIES TO STEAL APPLICATION ACCESS TOKENS

Summary from the TLDR InfoSec newsletter

This blog post is a deep dive into mechanisms for stealing application access tokens and detection and mitigation strategies. It begins by exploring how access tokens are used and provides examples of how to use tools like AADInternals and Peirates along with some examples of how APTs steal tokens. The post then suggests methods for detecting access token compromise in Azure and provides a sample query to run to search for compromise. It provides mitigation techniques such as auditing logs and specific recommendations for ways to restrict web-based content on AWS, GCP, and Azure.